diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index c985f736..e50318a8 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -2437,7 +2437,8 @@
 
 - macro: trusted_logging_images
   condition: (container.image.repository endswith "splunk/fluentd-hec" or
-              container.image.repository endswith "fluent/fluentd-kubernetes-daemonset")
+              container.image.repository endswith "fluent/fluentd-kubernetes-daemonset" or
+              container.image.repository endswith "openshift3/ose-logging-fluentd")
 
 - rule: Clear Log Activities
   desc: Detect clearing of critical log files